Your company is taking a more proactive approach to security. You want to generate an alert when a binary hash first appears in your environment. What should you do?

The correct answer is C. Write a rule to examine file-related events that join with derived context for hashes in the entity. To generate an alert when a binary hash first appears, you should write a detection rule for file- related events that joins with derived context for hashes in the entity graph and compare against the first_seen_time field. This ensures the rule triggers only when the hash is…

Detecting Threats

Question

Options

AEnable the Applied Threat Intelligence - Curated Prioritization rule set in curated detections.
BNavigate to the Alerts & IOCs page in Google Security Operations (SecOps). Create a filter that
CWrite a rule to examine file-related events that join with derived context for hashes in the entity
DCreate a table by using the Google Security Operations (SecOps) statistics in search to examine

How the community answered

(35 responses)

A
17% (6)
B
3% (1)
C
71% (25)
D
9% (3)

Explanation

To generate an alert when a binary hash first appears, you should write a detection rule for file- related events that joins with derived context for hashes in the entity graph and compare against the first_seen_time field. This ensures the rule triggers only when the hash is newly observed in your environment, providing proactive detection of potentially malicious binaries.

Topics

#first-seen hash detection#entity context graph#YARA-L rules#binary hash alerting

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice